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Abstract 

We introduce a logic specifically designed to support reasoning about social 
choice functions. The logic includes operators to capture strategic ability, and 
operators to capture agent preferences. We establish a correspondence between 
formulae in the logic and properties of social choice functions, and show that the 
logic is expressively complete with respect to social choice functions, i.e., that ev- 
ery social choice function can be characterised as a formula of the logic. We prove 
that the logic is decidable, and give a complete axiomatization. To demonstrate the 
value of the logic, we show in particular how it can be applied to the problem of 
determining whether a social choice function is strategy-proof. 

1 Introduction 

Social choice theory is concerned with collective decision making in situations where 
the preferences of the decision makers may differ |3|. Social choice theorists have 
developed a range of procedures, such as voting protocols, to support such collective 
decision making, and have developed a range of criteria with which to characterise the 
properties of such procedures. Such criteria are usually expressed axiomatically, and a 
major concern of social choice theory is to study the extent to which decision making 
procedures do or do not satisfy these axioms liSi l2l [71 1721 . 

In short, the aim of the present paper is to develop a logic that is explicitly intended 
for reasoning about social choice procedures. We focus on social choice functions, 
a class of social choice procedures that select a single social outcome as a function 
of individual preferences. Voting procedures of the type used in political elections 
throughout the democratic world are perhaps the best-known examples of social choice 
functions. A voting procedure determines the winner of an election as a function of the 
votes cast; votes can be understood as an expression of voter preferences. 

One interesting issue that arises in voting procedures is the extent to which voters 
are incentivised to truthfully report their preferences when voting. For example, sup- 
pose we have two voters, 1 and 2, who vote among three candidates, x, y, and z for a 
role that is currently filled by x. The voting procedure used in this example says that, 
if there is a unanimously preferred candidate, then that will be chosen, otherwise the 
candidate x remains. Suppose the tiTie preferences of 1 are given by z <i ^ <i y and 
those of 2 are x <2 y <2 Z- If the social choice function was presented with these true 
preferences, candidate x would be chosen (since there is no consensus). However, if 
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voter 2 would instead claim his preferences were x <2 z <2 y while 1 revealed its true 
preferences, then 2 would be better off, since y would be chosen, rather than x, and 
agent 2 prefers y over x. This issue suggests the following problem: Can we design 
a voting procedure that is "immune" to such misrepresentation, i.e., in which a voter 
can never do any better than by truthfully reporting its preferences? The term strategy 
proof is used to refer to such voting procedures. In fact, fundamental results in social 
choice theory tell us that there are severe limits to the development of strategy-proof 
voting procedures [7, 12J, and for this reason, developing and analysing social choice 
procedures is a lively and highly active research area. 

The long-term aim of our work is to develop formal tools to assist in the analysis 
and design of social choice procedures. In particular, we hope to develop techniques 
that will permit the automated analysis of social choice procedures. To this end, we 
aim to develop logics that allow us to formally express the properties of social choice 
procedures, such that these languages may be automatically processed. Our view is that 
logic can provide a powerful tool for the analysis of social choice procedures lfm[T6l . 
Such logics can be used as query languages for social choice procedures: given some 
property P of a social choice procedure, we aim to be able to encode the property P 
as an expression of our language, which we then pose as a query to an automated 
analysis system. Working towards the long-term goal, the present paper presents a logic 
for reasoning about social choice procedures, and in particular, for analysing strategy 
proofness. 

The remainder of the paper is structured as follows. In Section|2]we recall the main 
concepts from game theory and social choice theory that we use throughout the paper. 
We then introduce our logic in Section |3] The logic is basically a modal logic 
which derives inspiration from the Coalition Logic of Propositional Control (CL-PC) 
Ill5i . The latter logic includes operators to capture strategic ability. We extend this 
with operators for capturing agent preferences. The basic idea is to model an agent's 
preferences via atomic propositions: a proposition p\^^. will be used to represent the 
fact that agent / has reported that he prefers outcome x at least as much as outcome 
y. The strategic abilities of agents are captured using a CL-PC-like operator: an agent 
can choose any assignment of values for its preference variables that corresponds to a 
preference ordering. After presenting the syntax and semantics of the logic, we show 
how the logic can be used to characterise social choice functions, and show that the 
logic is expressively complete with respect to social choice functions, i.e., that every 
social choice function can be characterised as a formula of the logic. We give a com- 
plete axiomatization for the logic. To demonstrate the value of the logic, in Section |4] 
we formalise some properties of social choice functions and in particular, we show 
how it can be applied to the problem of determining whether a social choice function 
is strategy-proof. We conclude in Section|5] 

2 Background 

In this section, we present the basic definitions of game theory and social choice upon 
which we construct our framework ll6l [T0l . 

We begin with some notation. We assume that game forms and social choice func- 
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tions (to be defined hereafter) share the same domains of agents and outcomes. We 
denote by = {1, . . . , n) the finite set of agents (or players) and by K the finite set 
of social outcomes (outcomes hereafter). We use the letters a,b,c,. .. as constants of 
K. We use variables i,j, ... to denote agents, and outcomes will be denoted by the 

variables x,y,z, Typically, one can consider that the agents are the voters and the 

outcomes are the candidates in some election. 

We denote by L(K) the set of linear orders over K. (A linear order here is a relation 
that is reflexive, transitive, antisymmetric and total.) By using a linear order, we are as- 
suming the players cannot be indifferent between two distinct outcomes. A preference 
relation is a linear order of outcomes. Given K and A^, a preference profile < is a tuple 
(<i)i£N of preferences, where <, e L(K) for every /. The set of preference profiles is 
denoted by L(K)^. Note that we use the symbol <, for a preference relation for agents, 
which in this case happens to be reflexive (and we do not write <, for it). Also, we will 
use the symbol >,■ with the obvious meaning, i.e., y >, xiS x <,- y. 

Definition 1 (Social choice function) Given K and N, a social choice function (SCF) 
is a single-valued mapping from the set L(K)'^ of preference profiles into the set K of 
outcomes. 

For every preference profile, a social choice function describes the desirable outcome 
(from the point of view of the designer). 

Definition 2 (Strategic game form) Given the sets N and K, a strategic game form is 
a tuple (N, {Ai),K, o) where: 

Ai is a finite nonempty set of actions (or strategies) for each player i e A^; 
o : X/eAiA; — > K assigns an outcome for every combination of actions. 

A strategic game form is sometimes called a mechanism. It specifies the agents taking 
part in the game, their available actions, and what outcome results from each combina- 
tion of actions. We refer to a collection (fl/Oieiv, consisting of one action for every agent 
in A^, as an action profile. Given an action profile a, we denote by a, the action of the 
player /. 

Remark 1 There is a direct link between strategic game forms and social choice func- 
tions. Any social choice function can be viewed as a game form in which the set of 
actions of every agent is L(K) ( think of this as the preference profiles the agent can 
claim to be his), and the function o represents the social choice function (see [9]). For 
any SCF F, we denote its associated game form by g^. 

A strategic game is basically the composition of a strategic game form with a col- 
lection of preference relations (one for every agent) over the set of outcomes. 

Definition 3 (Strategic game) A strategic game is a tuple {N,(Ai),K,o,(<i)) where 
{N,(Ai),K,o} is a strategic game form, and for each player i e A^, <,■ is a preference 
relation over K. 
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In our context, when the actions A, in a game (A^, (A,), K, o, (<,)) are preference 
relations themselves, one should think of those as preferences that / can choose to 
report, whereas <,, encodes /'s real preferences. 

A solution concept defines for every game a set of action profiles - intuitively, 
those that may be played through rational action. Exactly which solution concept is 
used depends upon the application at hand: we will soon introduce a well-celebrated 
solution concept of Nash Equilibrium (see Example[T]l. 

Definition 4 (Solution concept) A solution concept SC is a function that maps a strate- 
gic game form {N, (Ai),K,o} and a preference profile over K to a subset of the action 
profiles. 

We now introduce a simple but fundamentally important solution concept: Nash equi- 
librium. 

Definition 5 (Nash equilibrium) Given a strategic game form g - {N, (A, ), K, o) and 

a preference profile < over K the set of Nash equilibria NE(g, <) is given as the set of 
action profiles in g such that no player would benefit from deviating unilaterally from 
his current action. More formally, (fli, . . .a„) e NE(g, <) iff for every player k and 
every e A^, we have o(fli , . . . . . . a„) <k o{a\, . . .a^ . . . a„). 

We can now introduce the notions of implementation and truthful implementation. 
The problem of implementation arises because a planner does not know the true prefer- 
ence profile of the players. Given a social choice function F involving a set of players 
and a set of outcomes K, the planner only knows that every player / e has some 
preference <,-, an element of L(K). 

We first define the case of (standard) implementation. Assuming a pattern of be- 
haviour - a solution concept SC - the role of the planner is then to design a mechanism 
(or game form) g such that for every possible preference profile < e L{K)^, the strate- 
gic game {g, <) admits at least one S'C-equilibrium, and every S'C-equilibrium leads to 
the outcome in K which is prescribed by the social choice function for the preference 
profile at hand, that is, the value of F(<). 

Definition 6 (Implementation) Given a solution concept SC, we say that the game 
form g — {N, (A,), K, o) 5C-implements the social choice function F if for every prefer- 
ence profile < e L{K)^ we have that SC(g, <) and 

a* e SC(g, <) implies that o{a*) — F{<) 

In words: the game form g 5C-implements F if for any game form {g, <) based on g, 
any outcome associated to a strategy profile in the solution concept SC is the same as 
what the social choice function would yield for the preference <. Or, more loosely: 
the game form g implements F if, for every preference profile < that we can associate 
with it, the outcomes in the game {g, <) and the result of F{<) agree at least on those 
claimed preferences that are in the solution concept of the game. 

The problem of implementation is illustrated in Figure [T] We say that the social 
choice function is SC-implementable if there is a game form that S'C-implements it. 



4 




c = (?,(<;,<)> 



Figure 1 : Implementation. The preference profiles < and <' are two arbitrary members 
of L(K)^. The left part represents the SCF F. F(<i,<2) = y and F(<'j, = x. The 
right part represents the strategic game form g instantiated, in the upper part with the 
preference profile (<i,<2) (game G - (g, (<i,<2))) and in the lower part with the 
preference profile (<j, (game G' - {g, (<\, <2)))- All the S'C-equilibria of G (and 
possibly also some others than (a'j, Oj)) lead to f (<i, <2)- In a like manner, all the SC- 
equilibria of G' lead to F{<\, <2). This has to be verified for every preference profile 
in LiKY^ and not only < and <' : if it holds, g is said to S'C-implement F. 

In some situations however, an SCF can be implemented by a strategic game form 
of which the space of action profiles corresponds to the space of preference profiles, 
and telling the truth is an equilibrium. We call a strategic game form in which the set of 
strategies of a player / is the set of preferences over K a direct mechanism. Hence, each 
player is asked to report a preference, but not necessarily the true one. An appealing 
class of direct mecharusms is that in which reporting the true preference profile is an 
equilibrium of the game consisting of the direct mechanism composed with the true 
preference profile. That is, for every <e L(K)^, the action profile where every player ; 
reports its true preference <,■ is an equilibrium of the game {g, <). We can define this 
notion for every solution concept SC. 

Definition 7 (Trutliful implementation) The direct mechanism g = (A^, (A,), K, o) 
truthfully 5C-implements the SCF F if for every true preference profile < and reported 
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Figure 2: Truthful implementation. The preference profiles < and <' are two arbitrary 
members of L{K)^. The left part represents the game form g'^ associated to the SCF F 
when the preferences of the two players are <i and <2. The game G - {g'^, (<i, <2)) 
admits an equilibrium at the action profile (<i, <2)- The right part represents g^ when 
the preferences of the two players are <'j and k'^. The game G' - {g^ , (<j, <'j)) admits 
an equilibrium at the action profile (< j , <'^. This has to be verified for every preference 
profile in L{K)^ and not only < and <': if it holds, g'^ is said to truthfully S'C-implement 
F. 

profile a* with a* —<ifor every i: 

a* e SC(g, <), and o(a*) — F(<) 

In words: g is a truthful 5C-implementation of F if, for every profile <, whenever 
the agents declare that to be their real preferences, this a solution concept SC, and the 
outcome in the game and the function F are the same. The problem of truthful imple- 
mentation is illustrated on Figure [2] We say that the social choice function is truthfully 
SC-implementable if there is a game form that truthfully 5C-implements it. Note that 
truthful implementations only require that the report of the true preference profile is 
an equilibrium, but it is not required that this equilibrium is unique. In general, other 
equilibria could be present that would not lead to the outcome prescribed by the SCF. 
However, this notion of implementation can be motivated. Indeed, it is assumed that 
playing a direct mechanism, if casting the real preference is an equilibrium strategy, an 
agent would be sincere. 

We illustrate the differences between the problems of implementation with some 
simple examples (a 'minimal' social choice scenario with only two voters and two 
alternatives), which demonstrates that the two notions are contingent and independent: 
a game form g can be both a truthful 5C-implementation and an 5C-implementation of 
a social function F, it can be both, and it can be either of them without being the other. 
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Figure 3: g does not A^/s-implement H. But g truthfully A^/s-implements H. 



Example 1 In this example we define some simple social choice functions, for all of 
them we set N — {1,2) and K — {a,b}. Also, for the sake of comparison between stan- 
dard and truthful implementations, we only consider direct mechanisms, since truthful 
implementations are not defined otherwise. 

First, consider the function H for which we claim that its associated game form g^ 
truthfully NE-implements H but g^ does not NE-implement it. H is the social choice 
function prescribing the outcome b if and only both agents prefer b over a. We write 
[a, b] for the individual order of preferences of the outcome a over the outcome b and 
[b, a] for the individual preference ofb over a. Hence, we have: 

H([a,b],[a,b]) = Hi[a,b],[b,a]) = H([b,a],[a,b]) = a; 
H([b,al[b,a]) = b. 

Figure^represents the four possible games {g^, <) where <€ L({a, fo))'''^'. In each 
of them, the circles indicate the action profiles that are Nash equilibria. The outcomes 
in bold are the outcomes o{a*) for which a* — <: in those outcomes, players have 
revealed their true preferences. So for instance, the outcome a in the upper left corner 
of the game {g^ , {{a, b], [a, b])} reads: 'the outcome in the game here is a and the voters 
reveal their true preferences '. For every preference profile <, the ticks / indicate that 
the action profile < leads to the outcome prescribed by the social choice function H 
and is a Nash equilibrium in the game (g^ , <}; Hence the game form g^ truthfully 
NE-implements H: all the bold outcomes are ticked. The cross f designates a problem 
with the (standard) implementation of H by g^ : in the game {g^ ,([b,a],[b,a])} the 
action profile ([a, b], [a, b]) is a Nash equilibrium and leads to the outcome a, however 
H([a,b], [a,b]) — b. Hence, g^ does not NE-implement H. 
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Figure 4: both A^/i-implements and truthfully A^/s-implements J. 



Let us next consider the social choice function J which is dictatorial for player 1, 
i.e., J is defined by 

J{[a,b],[aM) ^ J{[aMAb,a]) = a; 
J{[b,a],[aM) ^ J{[b,a],[b,a]) = b. 

The four possible games {g\ <) for J are depicted in Figure |4] It is easy to see 
that the circled outcomes in those games are Nash equilibria: they give the preferred 
outcome for 1 fso 1 cannot improve by deviating) and they are the same in a fixed row 
(so 2 cannot change the outcome). Moreover, it is also a straightforward check that for 
all those Nash equilibria, the outcome in the game {g' , <) is the same as J(<) (for in- 
stance, in the top left game, both equilibria yield a which coincides with J {[a, b] , [a, b]), 
and in the bottom left game, both equilibria yield b — J([b, a], [a, b]), etc): this justifies 
the ticks •/. So g NE-implements J. To show that g also truthfully NE-implements J, 
we need to check that all the bold outcomes in Figure^are circled and ticked ■/. 

Next, to give an example of an NE-implementation that is not a truthful one, con- 
sider the game form g^_. It is mathematically equivalent to the game form g' : the 
outcomes a and b are only inverted. Playing g'_, the player 1 would simply play the 
contrary to his true preference. This always yields a Nash equilibrium and the out- 
comes are always as prescribed by J. Hence, like g' , the game form g'_ is an NE- 
implementation of the social choice function J. However, since the player 1 needs to 
trick the game in order achieve a Nash equilibrium, it is easy to see that gi_ does not 
truthfully NE-implement J. The crosses f on Figure |5] mark the action profiles that 
correspond to the true preferences of the players, and we can see that their respective 
outcome always fails to be as prescribed by J. 
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Figure 5: g^L A^/s-implements J but does not truthfully A^/i-implement it. 



Finally, we argue that it is possible for a game form to be neither a NE-implementation 
nor a truthful implementation of a given function: take P such that P(<) — a for all 
profiles <. Moreover, for all <, let all outcomes in the matrix for {g^ , <} be b. For every 
<, every outcome in {g'^ , <) is a Nash equilibrium (no agent can change the outcome, 
let alone improve it). At the same time, for all a* we have b — o(a*) + P(<) — a, which 
shows that g does not NE-implement P. It does also not truthfully NE-implement it: 
take, for any <, a profile a* in the game {g^ , <) such that a* — <. We have already 
seen that o(a*) + P{<), which proves our claim. 

3 A Logic of social choice functions 

Following the tradition in implementation theory (cf. Remark [T}, we model social 
choice functions as a particular kind of strategic game form. In |13 | we proposed a 
logic for modelling strategic games on the basis of CL-PC. Every player controls a 
set of propositional variables and a strategy for a player amounts to choosing a truth 
value for the variables he controls. We adapt the ideas of 1 13] to game forms where the 
strategies of the players correspond to the reports of preferences. 

3.1 Semantics 

Let X be an arbitrary set of propositions. We can see a valuation of X as a subset V Q X 
where tt (i.e., true) is assigned to the propositions in V and ff (false) is assigned to 
the propositions in X \ V. We denote the set of possible valuations over X by 0'^. 
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In the presence of a set of players and a set of outcomes K, the set of propositions 
controlled by a player i e N is defined as At[i,K] - {p[^y \ x,y e K}. Every p'^^y is 
a proposition controlled by the agent / which means that / reports that it values the 
outcome x at least as good as y. We also define Af[A^, A'] = U,g^Af[/, A"], which is then 
the set of all controlled propositions. 

We can 'encode' a particular preference (or linear order) of player ; as a valuation 
of the propositions in At[i,K]. However, conversely, not all valuations correspond to 
a linear order preference. A strategy of a player / consists of reporting a valuation of 
At[i,K] encoding a linear order over K. For every player /, we define strategies[i,K] 
as a set of valuations V € ©^'[''^1 such that: (/) p[^^ e V, (ii) if x ^ y then p[^^, e V iff 
i V, and (/;■/) if e V and e V then e V. 

Remark 2 Every p\^^, could be seen as a predicative expression p(i,x,y) that would 
read that agent i reported to prefer the outcome x over y. However, since N and K are 
finite, we look at these expressions as a finite collection of propositions. The constraints 
of control in Figure |6| will be their propositional theory corresponding to the three 
preceding constraints on the valuations. 

For every coalition C Q N, let strategies[C,K] be the set of tuples vc - (v,);ec 
where v, e strategies[i,K]. It is the set of strategies of the coalition C. To put it another 
way, it corresponds to a valuation of the propositions controlled by the players in C, 
encoding one preference over K for every player in C. 

A state (or reported preference profile) is an element of strategies[N,K], that is, a 
strategy of the coalition containing all the players. We now define the models of social 
choice functions. 

Definition 8 (Model of social choice functions) A model of social choice functions 
over and K is a tuple M - {N, K, out, (<,)), such that: 

out : strategies[N ,K\ — > K maps every state to an outcome; 
For every i € A^, <,■ e L(K) is the true order of preferences ofi. 

Hence, every player / has two levels of preferences: (/) a true one, given by (<,) 
and (2) a reported one, given by a valuation in strategies[i, K]. 

Taking out the true preference profile from a model of SCF, we obtain a mere 
instantiation of a pre-Boolean game Q. It is required to assign every variable to one 
(actual control) and only one (exclusive control) player, but there are some constraints 
on the possible valuations ('non-full' control). In |i4J, actual and exclusive control are 
grasped by an assignment function (mapping every propositional variable to exactly 
one player), and the partial control is modelled by a set of constraints given as a set of 
satisfiable propositional formulae. 

The language X.'"^-^[N,K] is inductively defined by the following grammar: 

(fi T \ p I X I -.^ I (fiVip I Ocf I ^if 

where p is atom of At[N,K], x is an atom of K, i € A^, and C is a coalition. Given a 
model M and a state (i.e., a reported profile v), formula <>c(p reads that provided that 
the players outside C hold on to their current strategy v'c, the coalition C has a strategy. 
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i.e., a way to announce their profiles, such that ip holds. Formula ♦ji^ reads that ; locally 
(at the current reported profile) considers a reported profile where ip is true at least as 
preferable. 

Definition 9 (Truth values of X"'^[Af,/:]) Given a model M = {N,K,out,(<i)), we 
are going to interpret formulae of jy^^lN, K] in a state of the model. A state v = 
(vi, . . . , v„) in M is a tuple of valuations v,- e strategies[i,K], one for each agent The 
truth definition is inductively given by: 



M,v\=p 


iff 


p € Vifor some i G A' 


M,v\= X 


iff 


out{v) = X 


M,v\= ^(fi 


iff 


M,v'^ (fi 


M,v \= (pV i// 


iff 


M,v \= (p or M,v \= ij/ 


M,v\= Oc<p 


iff 


there is a state u such that 






Vi — Uifor every i i C and M, u\= <p 


M, V 1= ♦,■^0 


iff 


there is a state u such that 






out{v) <i out{u) and M,u\= <p 



We assume that player i only makes claims or announcements about its own pref- 
erences, and i controls nothing else, so the atomic clause could equivalently have read 

M,v\=p'^^yiSp'^^y€Vi 

The truth of (p in all models over a set of players A' and a set of outcomes K is 
denoted by |=a«/[a',a:] <P- The classical operators A, — >, <-> can be defined as usual. We 
also define ac(p - -iOc~'¥' ^iV - ~'^i~'<P- 

Tlieorem 1 (Decidability) ne problem of deciding whether a formula <p e £^^[N, K] 
is satisfiable is decidable. 

Proof. It suffices to remark that N and K are finite. Hence, we can enumerate every 
model of SCF over N and K and check whether (p is satisfiable in one state of one 
model. 

■ 

3.2 Ballots 

We think of a particular preference of L{K) encoded in the language of the propositions 
as a ballot. 

Definition 10 (Ballot) For every player i e N, we can see every <, e L{K) as a per- 
mutation [xi,X2 . ■ .] of the elements of K, where the more to the left the outcome is, 
the more it is preferred by the player i. We can reify in the language the reported 
preferences, that is, the ballot casted by the player i: 

ballOt,(<) ^P'x,>X2 ^P'x2>X, A . . ■Px„_,>x,^,- 
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Then, the formula 

ballot(<) = l\ ballot,(<) 

is a reification of the reported preference profile < — (<i, . . . , <„), consisting of one 
ballot for every player i e N. 

Remark 3 Note that for every < e L(K), the formula ballot(<) is true at one and only 
one state. The reader familiar with Hybrid Logic fJJ may think of the formula ballot(<) 
as a nominal, viz. a state label available in the object language. 

Example 2 Suppose that N — {1,2} and K — {a,b,c}. Let a preference profile 
(<", <") G L{Kf given by the data of the two permutations [a, c, b] and [c, a, b] repre- 
senting respectively the preferences of player 1 and 2. This reported preference profile 
can be represented in the language jy^^[{\,2], {a, b, c)] by the formula 

ballot(<") ^ p\^, Apl^^ ^Pl>a^pl>b- 

It is easy to verify that the constraints on the elements of strategies[l,K'\ and 
strategies[2, K] are sufficient for inferring a complete characterisation of the prefer- 
ence profile. The following is valid in the models of social choice functions over {1,2} 
and [a, b, c}: 

ball0t(<") ^ pI^, Apl^^ Apl^^. Apl^^Apl^^ Apl^i^ A ^pI^^ a ^pl A ^pl A 
Pl>a ^ Pl>h ^ pI>c ^ Pl>a A A A ^pI^^ a -.pl^^ A -.pl^^ 

3.3 Characterising an SCF 

Recall that a model of social choice functions is a tuple M = {N ,K,out,{<i)), where 
<, are the real preferences of the agents and the outcome function o assigns to every 
valuation an element of K. There is a one-one correspondence between valuations 
and preference profiles: the preference profile P{v) associated with valuation v is the 
relation < for which x >, y iff p\^^, € v. Likewise, the valuation V{<) associated with 
< is the set {p\^y \ x >, y], which collect all the atoms form ballot(<). This makes it 
possible to relate a model M with a social choice function F as follows. 

We say that a model M - {N, K, out, (<,)) and social choice function F : L{K)^ 
K correspond, if for every strategy profile < and its associated valuation v (i.e., for 
which y(<) = V and P(v) -<), we have o(v) - F(<). 

This correspondence can be syntactically defined in a formula p'^: 

^ [\ Ow(ballot(<) A F(<)) 

<£L(K)^ 

Note that <>n plays the role of the universal/global existential modality often noted 
E in the literature in modal logic: it allows us to quantify over all the possible valuations 
in ©A'lA'./f] or ballots. 

Given the outcomes K, the agents and the social choice function F, formula 
says that every profile < together with F{<) as an outcome appears in the model. Since 
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the states of a model are all possible profiles in L{K)^ , and every profile occurs exactly 
once, we might as well have defined as 

- [\ (ballot(<) ^ F(<)) 

<£L{Kf 

It is easy to see that the logic is expressively complete wrt. social choice functions. 
That is, for every SCF F over a set of players and a set of outcomes K, there exists a 
formula € £f'^^{N,K} characterising it. Even though it may not be optimal in terms 
of succinctness, it suffices to consider the conjuncts of formulae <0>A'(ballot(<) A x), for 
< e L(K) and F{<) - x. The next example shows, using a simple scenario, that we can 
sometimes obtain less naive and more compact characterisations. 

Examples Consider the following model of SCF (or game form) where player 1 
chooses rows, player 2 chooses columns and player 3 chooses matrices. There are two 
outcomes a andb. Hence, every player i controls the set of atoms {Pa>a^P'b>b'P'^a>b'P\>i)' 
Every player i has two strategies: p'a>a/^P'b>b^Pa>h^^P'b>a '^'^ Pa>a/^P'b>b^~'Pa>b^Pb>a' 
that we denote respectively by [a,b] and[b,a]. (In the logic A'"^^[{1, 2,3}, {a, b]], they 
are in fact equivalent to the formulae p'^^i^ and respectively.) 







[a, b] [b, a] 






[a,b] [b,a] 




[a,b] 


a a 






[a,b] 


a b 




[a,b] 


[b,a] 


a b 




[b,a] 


[b, a] 


b b 













We can represent it in the logic A'"^-^[{l,2,3},{a,b}] of social choice functions by 
the formula: 



- « ^ (pLb A Pl>b) V iplh A pI,) V (pI^, a pI^). 

Note that since out is functional, in the models of social choice functions with K — {a, b] 
the outcome b will hold whenever a does not. 

Going back to the social choice functions of Example [7] we invite the reader to 
check that 

P" -b^ipla^Plj 

p 

p — a 

3.4 True preferences 

In Section [l!2] we saw how to use the atoms in At\i, K\ to encode the reported preference 
or ballot of a player ;. These atoms do not necessarily represent the true preferences of 
the agents. We handle the true preferences of player / via the ♦,■ modality. 
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From our basic language X.'^'^^[N,K], we can also define an operator of interest 
concerning preferences. We can define the global binary operator of preferences i/' 
(f, corresponding to a preference between propositions. It reads "all (f are better than 
all f . 

ip <np^nN \l (ballot(<) A(ip ^ 0^(1// ♦,ballot(<)). 

< eL{K f 

Agent / judges the proposition (f at least as good as iff iff when the reported preference 
profile is < and (f holds at the state labeled by ballot(<), then, whenever i/r holds in a 
state, / would prefer the state labeled by ballot(<) (cf. Remark[3]). 

As in Definition[TO]for reported preferences, we can now reify the true preferences. 
Provided that x and y are two possible outcomes, the formula y Mj x captures the fact the 
player / prefers (globally) the outcome y over the outcome x. Hence, from a preference 
profile < e L(K)^, we reify the preference [xi,X2 . . .] of the player ; as follows; 

true,(<) = (-^1^1 X\K\-l) A ... A(X3 X2) A (X2 ■</ Xi). 

Then, the formula 

true(<) = y'y true,(<) 

ieN 

is a reification of the true preference profile <= (<i , . . . , <„). 

Remark 4 Whenever in a model of social choice function M the true preference of 
a player i is such that x <,■ y, then the formula x ■^i y is true at every state of M. 
However, the other way around does not hold. Indeed, when either x or y is not a 
possible outcome of a model, the formula x <i y is always true for every i. From the 
definition, x -^t y ^ Uj^ V< eL(A')"(ballot(<) A (y — > Um{x — > ♦,ballot(<)). Hence, if y 
is not a possible outcome, the main implication y — > n^ix — > ♦,ballot(<)) is always 
true for y being always false. Likewise, if x is not a possible outcome, the implication 
X ♦,ballot(<) is always true for x being always false. In turn, it makes the main 
implication always true. Also, V< eiiKf ballot(<) will always be satisfied since a state 
of evaluation represents a ballot by definition. 

The object language does not allow to talk about true preferences on impossible 
outcomes. This observation will have a consequence in the way we prove the com- 
pleteness of the logic. 

3.5 Axiomatics 

The axiomatization of the models of social choice functions is presented in Figure |6] 

Constraints of control {refi), (antisym-total) and (trans) say that every player casts 
an appropriate valuation of its controlled atoms: a valuation must encode a linear or- 
der. (compU) defines the local ability of coalitions in terms of local abilities of sub- 
coalitions. The transitivity of the operator Oc is the consequence of (compU). Hence, 
together with iT(i)) and it makes of Oc an S5 modality, (empty) means that 

the empty coalition has no power. (compU) and (confi) together make sure that the 
agents' choices are independent, iexclu) means that if an atom is controlled by a player 
the other players cannot change its value, {ballot) makes sure that an agent is always 
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Constraints of control 


(refl) 


P',>, 


(antisym-total) 


pLy ^ M>,- ' where xty 


{trans) 


P',>y ^ Py>z P'x>z 


Propositional control 


{Prop) 


if , where 1/3 is a propositional tautology 


{Kii)) 


□/(^c ->!/')-> {anp Ditf/) 


{T{i)) 




(S(0) 


(f -> □,0,(/) 


{compU) 


□c, □c,</' <-> nc,uc,V 


{confl) 


OiOjip njOi<p 


{empty) 


ni/,<f «-> <f 


{exclu) 


{OiP A Oj-ip) —> {Ujp V Dj-ip) , where 7 t i 


{ballot) 


O,ballot,(<) 


{comp-At) 


Oci^i A Oc,i52 Oc,uC2(^i A (^2) 


Outcomes and preferences 


{fund) 




{func2) 


(ballot(<) A ^) ^ □„(ballot(<) </)) 


{incl) 




{K{<,)) 


-» lA) -» (H,-^ ^ ■,^/') 


(4(<,)) 




{antisym') 


(ballot(<) A ♦,ballot(<') -> □«(ballot(<') ^ ■,-.ballot(<) 


{total') 


(ballot(<) A ♦,ballot(<') v □jv(ballot(<') ♦iballot(<) 


{unifPref) 


(x A ^ (x -4, y) 


Rules 




{MP) 


from h — > (A and h infer h 


{Nec{u,)) 


from h if infer h □,(/? 



Figure 6: Log/c of social choice functions A'"^^{N,K\. i ranges over A^, Ci and C2 over 
2^, X and y are over A", and < is over L{K)^ . 61 and ^2 two formulae from X"'^ [A^, A"] 
that do not contain a common atom from At[N,K]. ip represents an arbitrary formula 
of Xf^^ [N, K], and p an arbitrary atom in At[N, K]. 



locally able to cast any preference. From (comp-At), provided that 61 and 62 do not 
contain a commonly controlled atom, if a coalition C\ can locally enforce di and C2 
can locally enforce 62 then they can enforce 6] A 62 together. 

Axiom (fund) forces the fact that for every action profile there is one and only 
one outcome, {fund) ensures that the outcomes are only determined by the valuations. 
(incl) ensures that if something is settled, a player cannot prefer its negation. (4(<,)) 
characterises transitivity, (antisym') and (total') force that the relation of preference 
over states is antisymmetric and total (and hence, in particular, this relation is reflex- 
ive). Finally, (unifPref) specifies a fundamental interaction between preferences and 
flie outcomes. If the casted preference profile at hand leads to x and agent / prefers an 
action profile leading to y, then at every action profile leading to x, agent / will prefer 
every action profile leading to y, that is, all y are better than all x. 

The logic has a clear flavour of normal modal logic Q. The presence of (K(i)) 
with the necessitation rule (Nec(Di)) gives to the operator □,■ the property of normality. 
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The necessitation rule for the operator ■, holds because of (Nec(aj)) and the axioms 
(compU) and {incl). The normality of the modality ■/ then follows from {K{<i)). 

The axiomatics is largely inspired by the axiomatics of the logic of games and 
propositional control (henceforth LGPC) presented in |fT3l . The logic LGPC is de- 
signed to model strategic games in general. The agents have arbitrary strategies, and 
preferences allowing for indifference between two different outcomes. On the other 
hand, in this paper we focus on SCFs and hence on particular strategic games that 
'represent' an SCF (cf. Remark[T]i. 

While in LGPC we had an axiom saying that every atom was actually controlled 
by at least one agent, here we are more specific as we know a priori which atoms 
are controlled by a given agent. This is the role of the axiom (ballot). Constraints of 
controls are also specific to the present study. The truth values of the controlled atoms 
cannot be independent of each other as we use them to encode preferences. In LGPC, 
all valuations of the controlled atoms were permitted. 

Theorem 2 (Soundness and completeness) A*'^-'^ [A^, K] is sound and complete with 
respect to the class of models of social choice functions. 

Proof. The proof of completeness first gives an equivalent but more standard semantics 
to the logic: the Kripke models of SCF. Then we build tlie canonical model. For every 
consistent formula if, we show how to isolate a sub-model that we prove is a Kripke 
model of SCF that satisfies ip. 

Further details are given in the Appendix. 



4 Applications 

We have already demonstrated that the language allows to completely characterise an 
SCF. In this section we show how we can express properties of social choice functions 
in the language and apply the logic to reason about them. 

The language can be used to characterise requirements on social choice functions. 
We first illustrate that with some simple properties, namely citizen sovereignty and 
non-dictatorship. Next, we will characterise a dominant strategy equilibrium. Finally, 
we provide a formalisation of monotonicity and strategy-proofness, and use standard 
results of SCT to show how we can use the logic to check whether an SCF is imple- 
mentable in a dominant strategy. 

4.1 Citizen sovereignty and non dictatorship 

We say that an SCF satisfies citizen sovereignty iff every outcome in K is feasible. That 
is, no outcome is rejected independently of the individual opinions. It is defined as 
follows. 

Definition 11 (Citizen sovereignty) An SCF F satisfies citizen sovereignty iff for ev- 
ery X e K there is a < e L{K)^ such that F(<) — x. 
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The next formula is a straightforward translation of the definition of citizen 
sovereignty in the language of social choice functions. 



CITSOV = /\ Onx. 



xeK 

We say that an SCF satisfies non dictatorship iff no player can always impose its 
favourite outcome. 

Definition 12 (Non-dictatorship) An SCF F is non dictatorial ijffor every player i G 
there is a ballot < e L{K)'^ such that F(<) <,- yfor some y e K \ {F(<)}. 

This says that for every player, there is a ballot < whose outcome is F{<), and / prefers 
an outcome that is not F(<). 

We can rewrite the definition of non dictatorship into the language of social choice 
functions as follows. 



NODICT = /\ Oa, y xA y p\ 

ieN \xeK \ yeK\{x 



W 

y>x 



The following proposition is immediate. 
Proposition 1 Consider a social choice function F and a formula characterising it. 

1. F has the property of citizen sovereignty iff\=A"f[N,K] ~* CITSOV. 

2. F is non dictatorial iff\=A"-'f[N.K] ^ NODICT. 



4.2 Dominant strategy equilibrium 

Citizen sovereignty and non dictatorship are possible properties of a social choice func- 
tion: their formulations in logic are globally true (or false) in a model of SCF. However, 
the logic is also able to formalise solution concepts, which are properties of states. In 
ifTSl . we characterised several solution concepts (dominant strategy equilibrium, Nash 
equilibrium, core membership. . . ) that are directly applicable in the logic of the present 
work. 

In order to formalise strategy-proofness later, we need to characterise a dominant 
strategy equilibrium. A dominant strategy equilibrium captures a particularly important 
pattern of behaviour. It arises when every player plays a dominant strategy, that is, a 
strategy that would represent the best choice whatever the other agents play. We define 
it directly in our models of SCF. 

Definition 13 (Dominant strategy equilibrium) Let v* he a state in amodel of social 
choice functions {N ,K,out,{<i)). v* is a dominant strategy equilibrium iff for every 
player i e and every strategy u^wi] e strategies[N \ {/), K], we have out(uQ . . .u'- . . . u„) 
<i out{uQ ... V* ... M„) for every u'- G strategies[i, K]. 
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A dominant strategy equilibrium is a strong solution concept: such an equilibrium 
does not depend on the knowledge of an agent / about the strategies or preferences of 
other players. 

It is convenient to introduce the notion of best response by an agent /. 

BR,- = \Jix A □,>ix). 

xeK 

A player / plays a best response in a state if, x being the outcome, for every deviation 
of i, i prefers x. 

We can now define strategy dominance in terms of best response: 

DOM ^ f\ □w\|,|BR,-. 

ieN 

We have a strategy dominant state if the current choice of every player ensures them a 
best response whatever other agents do. 

Proposition 2 Assume a model of social choice functions M and a state v*. We have 
that V* is a dominant strategy equilibrium iffM, v* |= DOM. 



4.3 Monotonicity and strategy-proofness 



One important property of SCF is monotonicity, as this property can affect the imple- 
mentability of social choice functions. 

Definition 14 (Monotonicity) An SCF F is monotonic iff for all {<, <') c L(K)'^ and 
X € K, if F{<) — X and if for all i € A^, for all y & K we have that that y <,■ x implies 
thaty <■ X, then, F{<') - x. 

We propose to characterise monotonic social choice functions. We define 

A< m.Kf A<' euKf A.vE/f [Oiv(ballot(<) A x)^ 

AieN Avejf (Oiv(ballot(<) A p;,,,,) ^ 
OA,(ballot(<') A ^ OA,(ballot(<') a x)] 

Although it may appear rather complex, the predicate MON is essentially nothing 

in our language X,^'^f[N,K]. The following 



MON 
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more than the expression of Definition 
proposition is immediate. 

Proposition 3 Consider a social choice function F and a formula characterising it. 
F is monotonic iff 

^K-^t[N,K] ^ MON. 

Monotonicity does not depend on the true preference profile of the players. Ac- 
cordingly, our definition does not involve the modalities of preference ♦/^ and ip <i i}/. 
Capitalising on standard results from social choice theory, we will show that using 
the full expressivity of our language (that is, using true preference modaUties) we can 
obtain a much simpler formulation. 

We say that an SCF is strategy-proof if for every preference profile, telling the truth 
(reporting the true preference) is a dominant strategy for every player. 
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Definition 15 (Strategy-proofness) An SCFF is strategy-proof iffF is truthfully DOM- 
implementable. 

Hence, a choice function is strategy-proof when it is truthfully implementable in domi- 
nant strategy: for every preference profile, reporting their true preference is a dominant 
strategy for every player 

The revelation principle |7| is a central result in implementation theory. It states 
that if an SCF is DOM -implementable, then it is truthfully DOM-implementable. It is 
true in general even if L{K) is based on weaker orders. The revelation principle tells 
us that if an SCF F is implementable in dominant strategies then there exists a direct 
mechanism such that for every preference profile <, truth telling (every player / reports 
</) is a dominant strategy and the outcome is F{<). 

Truthful implementations are rather weak; it is easier in general to implement a 
choice function truthfully than with 'standard' implementations. Indeed, in truthful 
implementations there might be an equilibrium that leads to an outcome different of the 
one prescribed by the SCF. But because in this paper we consider linear preferences, 
and we assume that players cannot be indifferent between two distinct outcomes, such 
a situation cannot happen. Thus, we can be more specific than the revelation principle. 

Tlieorem 3 ([6, Corollary 4.1.4]) A direct mechanism g truthfully implements an SCF 
F in dominant strategies iff g DOM-implements F. 

Hence, when working in dominant strategies with linear preferences, the concepts of 
implementation and truthful implementation coincide. 

We propose to characterise strategy-proof social choice functions as follows: 

STRPROOF = l\ [true(<) ^ (ballot(<) ^ DOM)] 

< £L(K f 

The formula STRPROOF is an immediate reformulation of the definition of strategy- 
proofness in our language of social choice functions. 

Proposition 4 Consider a social choice function F and a formula characterising it. 
F is strategy -proof iff 

^K"f\N,K\ ^ STRPROOF. 

This Proposition provides us with a general procedure to check whether a social 
choice function is strategy -proof Moreover (because of Theorem [3]), because we re- 
strict our attention to linear preferences, it allows us to check whether an SCF is DOM- 
implementable. 

Example 4 We can verify for instance that the social choice function characterised in 

Example^is strategy-proof. 

NA-/[|l,23),l«,ft)] (« ^ (Pl>t ^ Pl>b) V ipl^h A pI^i) V {pl^, A p]^^)) 
STRPROOF. 

Monotonicity sometimes implies implementability and this is actually the case in 
our setting. Since we are working with rich domains of preference^ and linear order- 
ings the following result holds. 

' The notion of a rich domain is some tangential to the purposes of this paper. Briefly, our domain of 
preferences is rich because we allow every linear order of K. See 16] Sec. 3.1] 
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Theorem 4 (|[6l Cor. 3.2.3, Th. 4.3.1]) An SCF is truthfully implementable in domi- 
nant strategies iff it is monotonic. 

This standard result of implementation theory shows that in our setting, the notions 
of monotonicity and of strategy-proofness match. Trivially we are actually able to 
substantially simplify the formula MON, our characterisation of monotonicity in the 
formal language. Indeed, as a consequence of Theorem]?] we have the following. 

Proposition 5 

^K-^nN,K] MON ^ STRPROOF. 

5 Discussion and perspectives 

We have presented the problem of direct implementation in social choice theory and 
proposed a logical formalisation of it. We were able to give a sound and complete ax- 
iomatization to the logic. We showed how we can characterise social choice functions 
and properties of social choice functions. And finally, we have demonstrated the value 
of the logic by proposing a general logical procedure for checking whether a social 
choice function is strategy-proof. 

Our logical language is a formal counterpart of the language of "natural mathemat- 
ics" that is typically used in social choice theory. There are however two features that 
make it particularly useful: (;) it is supported by a non ambiguous semantics; and (//) 
the resulting logic is decidable. 

Section [4] suggests a logical methodology for reasoning about problems of social 
choice theory with the logic of social choice functions. Let a collection of properties 
of social choice theory Pi,i e {!,...«) be characterised in the logic A"'^[A^, K} by p''', 
respectively. 

1 . We can use the logic in order to check whether an SCF satisfies a certain prop- 
erty. An SCF F characterised by has the property P\ iff — > p^' is derivable 
mK"=f[N,K]. 

2. We can use the logic in order to evaluate the strength of constraints in SCT. PI is 
a property weaker than P2 iff the formula p^^ — > p^' is derivable in K^'^^[N,K\. 
For instance, instead of using a result of SCT to prove Proposition ]5] we could 
actually use the logic to automatically verify that monotonicity and strategy- 
proofness coincide in the current setting. More interestingly, we could use it to 
prove new theorems. 

3. We can use the logic for mechanism design. Building a mechanism that imple- 
ments a social choice procedure satisfying the properties P1,P2, ... 
Pn consists of finding a model for the formula p^' A p^ A ... A p''". 

We believe these are exciting possibilities for social choice theory and logic, and as the 
logic is decidable, they are in principle possible. 
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Proof of Theorem |2] 

A^'^f[N^K] is sound and complete with respect to the class of models of social choice 
functions. 

Proof. It is routine to verify that all principles of Figure^are valid. We show that if a 
formula is consistent, it is provable in the system A'"'^[N,K]. 

We first introduce the Kripke models of SCF. A Kripke model of SCF is a tuple 
M = <A^, K, S, (Ri), (Pi), V) such that: 

• and K are parameters; 

• S^{V e ©^'[^-^l I V/ e A^, 3y,- e strategies[i,K] s.t. V = U,<=A,y,); 

• V is a valuation function of At[N, K]U K where for every v e S: 

- pe V(v) iffp e V, p e At[N,K]; 

- there is a unique x e K s.t. x e V(v); we say that the model is based on 
the outcome function out^ when out^{v) = jc iff jc e V{v)]. 

• RiVU iff Vj — Ujfor all j + i; 

• there is a <^ & L{Kf s.t. PiVU iff (if x e V(v) and y e V(u) then x <f y); ['^ we 
say that the model is based on <'*^]. 

Truth values of Oi(p and in a Kripke model of SCF are obtained in the standard 
way from the relations Ri and Pi, respectively. 

Clearly, for every Kripke model M based on out^ and <^, we can construct a 
model of social choice functions M'^^'^ — {N,K, out^ , (<f)} and reciprocally. 

By construction, there exists a bijectionf : S — > strategic s[N,K] that associates a 
state s in M to a state v = (vi . . . v„) in M""^^ in such a way that for every p e At[i, K], 
we have p e V(s) iffp e v/. 

The following is easy to see. 
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Claim 1 M,s\=tp iffW^fjis) \= (f>. 



Hence, the proof of the theorem can he reduced to a proof of completeness of the logic 
wrt. to the class ofKripke models ofSCF. 

Let H be the set of maximally consistent sets (mcs.) of A^'^f[N,K]. We define the 
proper canonical model M""" — {N ,K,S,{Ri),{Pi),V) as follows. N and K are the 
parameters of the logic. S = E. /?,rA iffVd € A, 0,5 G T. P,rA iff\/6 € A, ♦/^ e Y. 
p e y(r) iffp e A. X e ViT) iffx e A. 

Given an mcs. Yq we define the set of mcs. 'describing ' the same SCF and where 
the players have the same true preferences (modulo the preferences concerning some 
outcome which is not feasible in the SCF): 

ClusteriYo) = {Fi | V < e UKf,'ix e /:,OAr(ballot(<) A x) g 
Fi #0^(ballot(<) A x) G To) n | V; g ^,V{x, j} c 
K,x<iy&Y2ijfx <iy&Yo\ 

Let If be a consistent formula of Xf^f [N , K}. There is an mcs. s.t. if e T^. The 
proof consists in constructing a model from such that it is indeed a Kripke model of 
SCF and there is a state satisfying (p. 

We define = {N',K\ S', R'., P'., V')from M'"" as follows: 

• N' and K' = K; 

• S' - B,\auster{r^); 

• ^'i - Rl\Cluster{T^)' 

• Pi - Pi\auster{T^)! 

• pe V'(A) ifi'p e V(A), A e S'. 

It is immediate that the truth lemma holds. 
Claim 2 M^,Y \^ 6 iff 6 €Y. 
Hence, M^pSip \= <f- 

The set of states in Kripke models of SCF is defined as the set of valuations of 
At\_N, K] encoding a preference profile. We prove that there exists a bijection between 
S' andL(Kf. 

Claim 3 The following statements are true: 

L VA G S', 3! < G L{K)^ s.t. ballot(<) e A; 

2. V < G L{Kf,3\A G S' s.t. ballot(<) g A. 

The first part of the claim follows from the constraints of control (refi), 
(antisym-total) and (trans). We now argue that for every < G L{K)^ , there is exactly 
one AeS' such that ballot(<) e A. Let < e L{ICf. We have h Oiballot,(<) by (ballot). 
With (comp-At), we find that V- OArballot(<). Hence, OArballot(<) e F^, and there must 
be an mcs. A s.t. ballot(<) g A. Now suppose that A' G S' also contains ballot(<). By 
(fund), A and A' contain the same formulae. Then A' = A, which proves the second 
part of the claim. 

As a consequence we will be allowed to use the formulae of the form ballot(<) as 
world labels in M^. 

We now prove the main claim of this proof. 
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Claim 4 is a Kripke model of SCR 

We first prove that for every mcs. T and A, we have that RiTA iff for all i + j we have 
that ballot/<) e r iyballot/<) e A. 

First, observe that for every i, Rj is an equivalence relation because by axioms 
(K(i)), (T(i)), (B(i)) and (compU) all □,■ are S5 modalities. 

f j. Suppose RjTA. Then by definition ^6 & Awe have 0,6 e F. For any < 
€ L(K)^ and j + i, suppose also that balloty(<) e A. By (exclu), □,ballot/<) e A. 
Then by hypothesis O,n,ballot,(<) e T, which by (B(i)) entails that ballotj(<) € F. 
Because RiTA is an equivalence relation, the same reasoning can be done to prove that 
j/ballot;(<) e F then ballot,(<) e A. 

(<^). Suppose V; /, V < e L(K)^ we have ballot/<) e F iffba\\o\j(<) e A. 

Suppose that ballot,(<') e A and 6 e A. Let us note <a the preference profile 
(<i, ... <'■ ... <„). We hence have ballot(<A) A 6 e A. Which by (fund) means that 
□iv(ballot(<) -^6)eA. 

From (exclu), □,- ballot,(<) e F. By (ballot), we also have that 
0,ballot,(<') 6 F. Hence, by S5, 0,ballot(<A) e F. 

We obtain that <>i6 G F. 

We now prove that there is a linear order < e L(K)^ such that f ,FA iff (if x e y(F) 
andy € V(A) then x <,■ y). For every i e N, we construct an order <° over the set K° — 
{x € K \ Onx e F^) such that x <° y iffx -^j y e F^. (Note that the reason we restrict 
the preliminary construction of the preference order to the set of possible outcomes 
is because the language is not strong enough to talk about impossible outcomes. See 
Remark^ A careless construction could lead to a relation over K that is not a linear 
order) 

Capitalising on (unifPref), it is immediate that <° is transitive f4(<i)j, antisymmet- 
ric ( antisym') and total and refiexive ( total'). Then <° is a linear order over K°. 

It is now easy to obtain a linear order <,■ over K such that for all x and y in K° we 
have X </ y iffx <° y. 

This completes the proof that is a Kripke model ofSCF. 

Then, for every consistent formula tp, there is a Kripke model ofSCF in which tp is 
satisfied. 
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